Generating attack graphs in agile security platforms

ABSTRACT

Implementations of the present disclosure include providing a graph that is representative of an enterprise network and includes nodes and edges, a set of nodes representing assets within the enterprise network, each edge representing a lateral movement path between assets, determining, for each asset, a contribution value indicating a contribution of an asset, determining lateral movements paths between a first asset and a second asset, providing a lateral movement path value representative of a difficulty in traversing a respective lateral movement path, identifying a set of remediations based on remediations defined for one or more vulnerabilities associated with issues identified for assets, each remediation mitigating a cyber-security risk within the enterprise network, and prioritizing the two or more remediations based on contribution values of assets, lateral movement path values of paths, and one of lateral movement complexity values of respective segments of paths and costs of respective remediations.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.16/554,833, filed on Aug. 29, 2019, which claims priority to U.S. Prov.App. No. 62/774,516, filed on Dec. 3, 2018 and U.S. Prov. App. No.62/829,696, filed on Apr. 5, 2019, the disclosures of which areincorporated herein by reference in their entireties.

BACKGROUND

Computer networks are susceptible to attack by malicious users (e.g.,hackers). For example, hackers can infiltrate computer networks in aneffort to obtain sensitive information (e.g., user credentials, paymentinformation, address information, social security numbers) and/or totake over control of one or more systems. To defend against suchattacks, enterprises use security systems to monitor occurrences ofpotentially adverse events occurring within a network, and alertsecurity personnel to such occurrences.

One challenge of cyber security is the lack of resources againstoverwhelming defense missions. Ideally, security requirements should bemanaged in a holistic view over the entire enterprise, from identitymanagement to compliance hardening of machines, from privacy concerns todata mapping, and from managing cyber issues before an event (proactiveprevention), during an event (Cognitive Security Operation Center), andafter an event (Cognitive Forensics). In reality, security teams have todrive prioritized decision-making, which allows them to determine thenext security requirement that should be addressed from a pool ofexisting and evolving security requirements across all security aspects.Prioritization of security requirements requires a rationale thatjustifies suggested remediations to be performed immediately, versusremediations that can be deferred. A cyber-aware organization needs toconstantly adjust requirements prioritization due to new emergingthreats and evolving computing environments that support an evolvingbusiness.

Traditional risk assessment efforts in the area of industrialenvironments are based on safety and security integration, cyber riskmanagement, and attack-specific modeling. These approaches, however,either propose a new system design that requires fundamental changes inthe system architecture, which is not applicable to many industrialbusinesses, or propose some theoretical approaches without addressingthe implementation and scalability challenges in heterogenous industrialenvironments.

SUMMARY

Implementations of the present disclosure are directed to an agilesecurity platform for enterprise-wide cyber-security. More particularly,implementations of the present disclosure are directed to an agilesecurity platform that determines asset vulnerability of enterprise-wideassets including cyber-intelligence and discovery aspects of enterpriseinformation technology (IT) systems and operational technology (OT)systems, asset value, and potential for asset breach including hackinganalytics of enterprise IT/OT systems. The agile security platform ofthe present disclosure executes in a non-intrusive manner.

In some implementations, actions include providing, by a securityplatform, graph data defining a graph that is representative of anenterprise network, the graph including nodes and edges between nodes, aset of nodes representing respective assets within the enterprisenetwork, each edge representing at least a portion of one or morelateral movement paths between assets in the enterprise network,determining, for each asset, a contribution value indicating acontribution of a respective asset to operation of the process,determining two or more lateral movements paths between a first assetand a second asset within the graph, providing, for each lateralmovement path, a lateral movement path value representative of adifficulty in traversing a respective lateral movement path within theenterprise network, identifying a set of remediations based on two ormore remediations defined for one or more vulnerabilities associatedwith issues identified for respective assets, each remediationmitigating a cyber-security risk within the enterprise network, andprioritizing the two or more remediations based on contribution valuesof assets, lateral movement path values of paths, and one of lateralmovement complexity values of respective segments of paths and costs ofrespective remediations. Other implementations of this aspect includecorresponding systems, apparatus, and computer programs, configured toperform the actions of the methods, encoded on computer storage devices.

These and other implementations can each optionally include one or moreof the following features: each lateral movement path value isdetermined based on at least one lateral movement complexity value and apreconditioned action; the preconditioned action is performed before alateral movement action of an attacked can be executed within theenterprise network; each segment represents a lateral movement between afirst node and a second node within the graph; after a path isremediated, a next path is selected based on lateral movement path valueand remediations are re-prioritized; the graph is generated by adiscovery service, the discovery service detecting assets using one ormore adaptors and respective asset discovery tools that generate anasset inventory and a network map of the enterprise network; each assetis identified as a target within the enterprise network, the targetbeing selected based on a disruption occurring in response to an attackon the target; the disruption is based on one or more metrics; and theone or more metrics include loss of technical resources, physicallosses, disruption in services, and financial losses.

The present disclosure also provides a computer-readable storage mediumcoupled to one or more processors and having instructions stored thereonwhich, when executed by the one or more processors, cause the one ormore processors to perform operations in accordance with implementationsof the methods provided herein.

The present disclosure further provides a system for implementing themethods provided herein. The system includes one or more processors, anda computer-readable storage medium coupled to the one or more processorshaving instructions stored thereon which, when executed by the one ormore processors, cause the one or more processors to perform operationsin accordance with implementations of the methods provided herein.

It is appreciated that methods in accordance with the present disclosurecan include any combination of the aspects and features describedherein. That is, methods in accordance with the present disclosure arenot limited to the combinations of aspects and features specificallydescribed herein, but also include any combination of the aspects andfeatures provided.

The details of one or more implementations of the present disclosure areset forth in the accompanying drawings and the description below. Otherfeatures and advantages of the present disclosure will be apparent fromthe description and drawings, and from the claims.

DESCRIPTION OF DRAWINGS

FIG. 1 depicts an example architecture that can be used to executeimplementations of the present disclosure.

FIG. 2 depicts an example conceptual architecture of an agile securityplatform of the present disclosure.

FIG. 3 depicts an example attack graph in accordance withimplementations of the present disclosure.

FIG. 4 depicts a conceptual diagram for cyber-attack risk calculation inaccordance with implementations of the present disclosure.

FIG. 5 depicts an example portion of an attack graph to illustrateimplementations of the present disclosure.

FIG. 6 depicts an example of determining complexity of attack paths inaccordance with implementations of the present disclosure.

FIG. 7 depicts an example process that can be executed in accordancewith implementations of the present disclosure.

FIG. 8 depicts an example process that can be executed in accordancewith implementations of the present disclosure.

Like reference symbols in the various drawings indicate like elements.

DETAILED DESCRIPTION

Implementations of the present disclosure are directed to an agilesecurity platform for enterprise-wide cyber-security. More particularly,implementations of the present disclosure are directed to an agilesecurity platform that determines asset vulnerability of enterprise-wideassets including cyber-intelligence and discovery aspect of enterpriseinformation technology (IT) systems, and enterprise operationaltechnology (OT) systems, asset value, and potential for asset breachincluding hacking analytics of enterprise IT/OT systems performed in anon-intrusive manner. In general, and as described in further detailherein, the agile security platform of the present disclosureprioritizes risks and respective remediations based on vulnerabilitiesof assets within an enterprise network (e.g., cyber intelligence anddiscovery aspect of IT/OT systems), the value of the assets, and theprobability that the assets will be breached.

Implementations of the present disclosure are described in detail hereinwith reference to an example context that includes cyber security andresilience in IT/OT systems. As described herein, implementations of thepresent disclosure enhance operational efficiency (e.g., time toresolution) in the example use case of cyber threat hunting and cyberresilience (defense). More particularly, implementations of the presentdisclosure enable users to quickly and efficiently sort and find IT/OTnodes in a graph of assets according to changing computational values ofcyber risks. In this manner, prioritization of security tasks is enabledto determine which is the next critical device or problem to address inan attack path (lateral movement).

It is contemplated, however, that implementations of the presentdisclosure can be realized in any appropriate context. For example,implementations of the present disclosure can be used to provideautomatic scaling in IT systems (e.g., controlling network traffic anddeciding which additional servers needs to be instantiated, in order toreduce bottle necks in transaction flows). As another example,implementations of the present disclosure can be used to regulatepermissions and/or access rights in IT systems (e.g., user permissionsand administrator rights for data access for optimizing userscredentials for network management, finding the most impactful user anddriving moderated authorization management based on risk and recovery).

In view of the example context, and as described in further detailherein, implementations of the present disclosure are directed todetermining impact assets within a network have on a process andprioritizing remediations to alleviate vulnerabilities of assets. Insome implementations, actions include providing, by a security platform,graph data defining a graph that is representative of an enterprisenetwork, the graph including nodes and edges between nodes, a set ofnodes representing respective assets within the enterprise network, eachedge representing at least a portion of one or more lateral movementpaths between assets in the enterprise network, determining, for eachasset, a contribution value indicating a contribution of a respectiveasset to operation of the process, determining two or more lateralmovements paths between a first asset and a second asset within thegraph, providing, for each lateral movement path, a lateral movementpath value representative of a difficulty in traversing a respectivelateral movement path within the enterprise network, identifying a setof remediations based on two or more remediations defined for one ormore vulnerabilities associated with issues identified for respectiveassets, each remediation mitigating a cyber-security risk within theenterprise network, and prioritizing the two or more remediations basedon contribution values of assets, lateral movement path values of paths,and one of lateral movement complexity values of respective segments ofpaths and costs of respective remediations.

In some implementations, the agile security platform of the presentdisclosure enables continuous cyber and enterprise-operations alignmentcontrolled by risk management. The agile security platform of thepresent disclosure improves decision-making by helping enterprises toprioritize security actions that are most critical to their operations.In some implementations, the agile security platform combinesmethodologies from agile software development lifecycle, IT management,development operations (DevOps), and analytics that use artificialintelligence (AI). In some implementations, agile security automationbots continuously analyze attack probability, predict impact, andrecommend prioritized actions for cyber risk reduction. In this manner,the agile security platform of the present disclosure enablesenterprises to increase operational efficiency and availability,maximize existing cyber-security resources, reduce additionalcyber-security costs, and grow organizational cyber resilience.

As described in further detail herein, the agile security platform ofthe present disclosure provides for discovery of IT/OT supportingelements within an enterprise, which elements can be referred to asconfiguration items (CI). Further, the agile security platform candetermine how these CIs are connected to provide a CI network topology.In some examples, the CIs are mapped to processes and services of theenterprise, to determine which CIs support which services, and at whatstage of an operations process. In this manner, a services CI topologyis provided.

In some implementations, the specific vulnerabilities of each CI aredetermined, and enable a list of risks to be mapped to the specificIT/OT network of the enterprise. Further, the agile security platform ofthe present disclosure can determine what a malicious user (hacker)could do within the enterprise network, and whether the malicious usercan leverage additional elements in the network such as scripts, CIconfigurations, and the like. Accordingly, the agile security platformenables analysis of the ability of a malicious user to move inside thenetwork, namely, lateral movement within the network. This includes, forexample, how a malicious user could move from one CI to another CI, whatCI (logical or physical) can be damaged, and, consequently, damage to arespective service provided by the enterprise.

FIG. 1 depicts an example architecture 100 in accordance withimplementations of the present disclosure. In the depicted example, theexample architecture 100 includes a client device 102, a network 106,and a server system 108. The server system 108 includes one or moreserver devices and databases (e.g., processors, memory). In the depictedexample, a user 112 interacts with the client device 102.

In some examples, the client device 102 can communicate with the serversystem 108 over the network 106. In some examples, the client device 102includes any appropriate type of computing device such as a desktopcomputer, a laptop computer, a handheld computer, a tablet computer, apersonal digital assistant (PDA), a cellular telephone, a networkappliance, a camera, a smart phone, an enhanced general packet radioservice (EGPRS) mobile phone, a media player, a navigation device, anemail device, a game console, or an appropriate combination of any twoor more of these devices or other data processing devices. In someimplementations, the network 106 can include a large computer network,such as a local area network (LAN), a wide area network (WAN), theInternet, a cellular network, a telephone network (e.g., PSTN) or anappropriate combination thereof connecting any number of communicationdevices, mobile computing devices, fixed computing devices and serversystems.

In some implementations, the server system 108 includes at least oneserver and at least one data store. In the example of FIG. 1, the serversystem 108 is intended to represent various forms of servers including,but not limited to a web server, an application server, a proxy server,a network server, and/or a server pool. In general, server systemsaccept requests for application services and provides such services toany number of client devices (e.g., the client device 102 over thenetwork 106). In accordance with implementations of the presentdisclosure, and as noted above, the server system 108 can host an agilesecurity platform.

In the example of FIG. 1, an enterprise network 120 is depicted. Theenterprise network 120 represents a network implemented by an enterpriseto perform its operations. In some examples, the enterprise network 120represents on-premise systems (e.g., local and/or distributed),cloud-based systems, and/or combinations thereof. In some examples, theenterprise network 120 includes IT systems and OT systems. In general,IT systems include hardware (e.g., computing devices, servers,computers, mobile devices) and software used to store, retrieve,transmit, and/or manipulate data within the enterprise network 120. Ingeneral, OT systems include hardware and software used to monitor anddetect or cause changes in processes within the enterprise network 120.

In some implementations, the agile security platform of the presentdisclosure is hosted within the server system 108, and monitors and actson the enterprise network 120, as described herein. More particularly,and as described in further detail herein, the agile security platformdetects IT/OT assets and generates an asset inventory and network maps,as well as processing network information to discover vulnerabilities inthe enterprise network 120. Further, the agile security platformprovides a holistic view of network and traffic patterns. In someexamples, the enterprise network 120 includes multiple assets. Exampleassets include, without limitation, users 122, computing devices 124,electronic documents 126, and servers 128.

In some implementations, the agile security platform provides one ormore dashboards, alerts, notifications and the like to cyber-securitypersonnel that enable the cyber-security personnel to react to andremediate security relevant events. For example, the user 112 caninclude a cyber-security expert that views and responds to dashboards,alerts, and/or notifications of the agile security platform using theclient device 102.

In accordance with implementations of the present disclosure, the agilesecurity platform operates over multiple phases. Example phases includean asset discovery, anomaly detection, and vulnerability analysis phase,a cyber resilience risk analysis phase, and a cyber resilience riskrecommendation phase.

With regard to the asset discovery, anomaly detection, and vulnerabilityanalysis phase, discovering what vulnerabilities exit across thevertical stack and the relevant use cases is imperative to be conductedfrom the enterprise IT to the control systems. A focus of this phase isto generate the security backlog of issues, and potential remediations.

Rather than managing each technology layer separately, the agilesecurity platform of the present disclosure addresses lateral movementsacross the stack. Through devices, communication channels (e.g., email),and/or operation systems, vulnerabilities are addressed within thecontext of a service (e.g., a service that the enterprise offers tocustomers), and a cyber kill chain to a target in the operationvertical, generating operation disturbance by manipulation of data. Thenotion of a CI assists in mapping dependencies between IT elementswithin a configuration management DB (CMDB). A so-called security CI(SCI) maps historical security issues of a certain managed securityelement and is mapped into a security aspect of a digital twin.

As a result, a stack of technologies is defined, and is configured in aplug-in reference architecture (replaceable and extensible) manner. Thestack addresses different aspects of monitoring, harvesting, andalerting of information within different aggregations views (dashboards)segmented according to owners and relevant IT and security users. Anexample view includes a health metric inserted within the dashboard ofan enterprise application. In some examples, the health metric indicatesthe security condition of the underlying service and hence, thereliability of the provided data and information. Similar to risks thatcan be driven by labor, inventory, or energy, security risk concern canbe presented and evaluated in the operations-level, drilled-through foradditional transparency of the issue, and can be optimally remediated byallocating investments to automation or to security and IT personal withadequate operations awareness.

With regard to the cyber resilience risk analysis phase, eachvulnerability may have several remediations, and each has a costassociated with it, either per internal personnel time, transaction,service, or retainer, as well as the deferred cost of not acting on theissue. A focus of this phase is to enable economical decision-making ofsecurity investments, either to be conducted by the IT and security teamor directly by automation, and according to risk mitigation budget.

In further detail, observing a single-issue type and its remediationsdoes not reflect the prioritization between multiple vulnerabilities.Traditional systems are based on global risk assessment, yet the contextin which the SCI is part of is missing. The overall risk of a processmatters differently for each enterprise. As such, remediation wouldoccur according to gradual hardening of a process according toprioritization, driven in importance and responsibility by theenterprise, not by gradual hardening of all devices, for example, in theorganization according to policy, without understanding of the impact onseparated operational processes. Hardening of a system should be adecision of the enterprise to drive security alignment with theenterprise.

In addition, as the system is changed by gradual enforcement andhardening, new issues are detected and monitored. Hence, making a bigbang decision may be not relevant to rising risks as they evolve.Prioritization according to value is the essence of this phase. It is amatter of what is important for the next immediate term, according tooverall goals, yet considering changes to the environment.

With regard to the cyber resilience risk recommendation phase, a focusis to simplify approved changes and actions by proactive automation. Intraditional systems, the action of IT remediation of security issues iseither done by the security team (such as awareness and training), bycreating a ticket in the IT service system (call for patch managements),and/or by tools that are triggered by security and monitored by IT(automatic deployment of security policies, change of authentication andauthorization, self-service access control management, etc.). Someoperations can be conducted in a disconnected mode, such as upgradingfirmware on an IoT device, in which the operator needs to access thedevice directly. Either automated or manual, by IT or by security, or byinternal or external teams, the entire changes are constantly assessedby the first phase of discovery phase, and re-projected as a metric in acontext. Progress tracking of these changes should also occur in agradual manner, indicating maintenance scheduling on similar operationalprocesses, hence, driving recommendations for frequent actions that canbe automated, and serve as candidates to self-managed by the operationsowners and systems users.

In the agile security platform of the present disclosure, acting is morethan automating complex event processing (CEP) rules on alerts capturedin the system logs and similar tools. Acting is started in areashighlighted according to known patterns and changing risks. Patterndetection and classification of events for approved automation processes(allocated transactions budget), are aimed at commoditization ofsecurity hardening actions in order to reduce the attention needed forprioritization. As such, a compound backlog and decision phase, canfocus further on things that cannot be automated versus those that can.All issues not attended yet are highlighted, those that are handled byautomation are indicated as such, and monitored to completion, with apotential additional value of increasing prioritization due to changingrisks impact analysis.

FIG. 2 depicts an example conceptual architecture 200 of an agilesecurity (AgiSec) platform in accordance with implementations of thepresent disclosure. The conceptual architecture 200 depicts a set ofsecurity services of the AgiSec platform, which include: an agilesecurity prioritization (AgiPro) service 204, an agile security businessimpact (AgiBuiz) service 206, an agile security remediation (AgiRem)service 210, an agile security hacker lateral movement (AgiHack) service208, an agile security intelligence (AgiInt) service 212, and an agilesecurity discovery (AgiDis) service 214. The conceptual architecture 200also includes an operations knowledge base 202 that stores historicaldata provided for an enterprise network (e.g., the enterprise network120).

In the example of FIG. 2, the AgiDis service 214 includes an adaptor234, and an asset/vulnerabilities knowledge base 236. In some examples,the adaptor 234 is specific to an asset discovery tool (ADT) 216.Although a single ADT 216 is depicted, multiple ADTs can be provided,each ADT being specific to an IT/OT site within the enterprise network.Because each adaptor 234 is specific to an ADT 216, multiple adaptors234 are provided in the case of multiple ADTs 216.

In some implementations, the AgiDis service 214 detects IT/OT assetsthrough the adaptor 234 and respective ADT 216. The discovered assetscan be used to generate an asset inventory, and network maps. Ingeneral, the AgiDis service 214 can be used to discover vulnerabilitiesin the enterprise network, and a holistic view of network and trafficpatterns. In some implementations, this is achieved through passivenetwork scanning and device fingerprinting through the adaptor 234 andADT 216. The AgiDis service 214 provides information about devicemodels. In some implementations, the automated asset discovery processuses active probing in the IT domain, and active and passive scanning inthe OT domain.

Once all assets (also referred to herein as configuration items (CIs))are discovered, threat intelligence knowledge-bases (e.g., iDefence,NVD, CVE) are used to extract cataloged vulnerabilities and securityissues associated with discovered CIs, as described in further detailherein. In the example of FIG. 2, the AgiInt service 212 includes avulnerability analytics module 236 and a threat intelligence knowledgebase 238 (e.g., CVE, CAPEC, CWE, Maglan Plexus, iDefence API,vendor-specific databases). In some examples, the AgiInt service 212discovers vulnerabilities in the enterprise network based on dataprovided from the AgiDis service 214. In some examples, thevulnerability analytics module 236 processes data provided from theAgiDis service 214 to provide information regarding possible impacts ofeach vulnerability and remediation options (e.g., permanent fix,temporary patch, workaround) for defensive actions. In some examples,the vulnerability analytics module 236 can include an applicationprogramming interface (API) that pulls out discovered vulnerabilitiesand identifies recommended remediations using threat intelligence feeds.In short, the AgiInt service 212 maps vulnerabilities and threats todiscovered IT/OT assets.

In the example of FIG. 2, the AgiHack service 208 includes an attackgraph (AG) generator 226, an AG database 228, and an analytics module230. In general, the AgiHack service 208 constructs AGs and evaluateshacking exploitation complexity. In some examples, the AgiHack service208 understand attack options, leveraging the vulnerabilities todetermine how a hacker would move inside the network and identifytargets for potential exploitation. The AgiHack service 208 proactivelyexplores adversarial options and creates AGs representing possibleattack paths from the adversary's perspective. The AgiHack service 208provides both active and passive vulnerability scanning capabilities tocomply with constraints, and identifies device and servicevulnerabilities, configuration problems, and aggregate risks throughautomatic assessment.

In further detail, the AgiHack service 208 provides rule-basedprocessing of data provided from the AgiDis service 214 to explore allattack paths an adversary can take from any asset to move laterallytowards any target (e.g., running critical operations). In someexamples, multiple AGs are provided, each AG corresponding to arespective target within the enterprise network. Further, the AgiHackservice 208 identifies possible impacts on the targets. In someexamples, the AG generator 226 uses data from the asset/vulnerabilitiesknowledge base 236 of the AgiDis service 214, and generates an AG. Insome examples, the AG graphically depicts, for a respective target, allpossible impacts that may be caused by a vulnerability or network/systemconfiguration, as well as all attack paths from anywhere in the networkto the respective target. In some examples, the analytics module 230processes an AG to identify and extract information regarding criticalnodes, paths for every source-destination pair (e.g., shortest, hardest,stealthiest), most critical paths, and critical vulnerabilities, amongother features of the AG. If remediations are applied within theenterprise network, the AgiHack service 208 updates the AG.

In the example of FIG. 2, the AgiRem service 210 includes a graphexplorer 232 and a summarizer 234. In general, the AgiRem service 210provides remediation options to avoid predicted impacts. For example,the AgiRem service 210 provides options to reduce lateral movement ofhackers within the network and to reduce the attack surface. The AgiRemservice 210 predicts the impact of asset vulnerabilities on the criticalprocesses and adversary capabilities along kill chain/attack paths andidentifies the likelihood of attack paths to access critical assets andprioritizes the assets (e.g., based on shortest, easiest, stealthiest).The AgiRem service 210 identifies remediation actions by exploringattack graph and paths.

In further detail, for a given AG (e.g., representing allvulnerabilities, network/system configurations, and possible impacts ona respective target) generated by the AgiHack service 208, the AgiRemservice 210 provides a list of efficient and effective remediationrecommendations using data from the vulnerability analytics module 236of the AgiInt service 212. In some examples, the graph explorer 232analyzes each feature (e.g., nodes, edges between nodes, properties) toidentify any condition (e.g., network/system configuration andvulnerabilities) that can lead to cyber impacts. Such conditions can bereferred to as issues. For each issue, the AgiRem service 210 retrievesremediation recommendations and courses of action (CoA) from the AgiIntservice 212, and/or a security knowledge base (not shown). In someexamples, the graph explorer 232 provides feedback to the analyticsmodule 230 for re-calculating critical nodes/assets/paths based onremediation options. In some examples, the summarizer engine 234 isprovided as a natural language processing (NLP) tool that extractsconcise and salient text from large/unstructured threat intelligencefeeds. In this manner, the AgiSec platform can convey information toenable users (e.g., security teams) to understand immediate remediationactions corresponding to each issue.

In the example of FIG. 2, the AgiBuiz service 206 includes an impactanalyzer 220. In general, the AgiBuiz service 206 associates servicesthat are provided by the enterprise with IT/OT assets, generates asecurity map, identifies and highlights risks and possible impacts onenterprise operations and industrial processes, and conducts what-ifprediction analyses of potential security actions remediations onservice health levels. In other words, the AgiBuiz service 206identifies risk for each impact predicted by the AgiHack service 208. Insome examples, the impact analyzer 220 interprets cyber risks andpossible impacts (e.g., financial risk) based on the relative importanceof each critical asset and its relative value within the entirety of theenterprise operations. The impact analyzer 220 processes one or moremodels to compare the financial risks caused by cyber attacks with thosecaused by system unavailability due to shutdown time forreplacing/patching critical assets.

In the example of FIG. 2, the AgiPro service 204 includes a prioritizingengine 222 and a scheduler 224. In some implementations, the AgiProservice 204 prioritizes the remediation recommendations based on theirimpact on the AG size reduction and risk reduction on the value. In someexamples, the AgiPro service 204 determines where the enterprise shouldpreform security enforcement first, in order to overall reduce the risksdiscovered above, and evaluate and probability to perform harm based onthe above lateral movements by moving from one CI to another. In someexamples, the AgiPro service 204 prioritizes remediation actions basedon financial risks or other implications, provides risk reductionrecommendations based on prioritized remediations, and identifies andtracks applied remediations for risks based on recommendations.

In some examples, the prioritizing engine 222 uses the calculated risks(e.g., risks to regular functionality and unavailability of operationalprocesses) and the path analysis information from the analytics module230 to prioritize remediation actions that reduce the risk, whileminimizing efforts and financial costs. In some examples, the scheduler224 incorporates the prioritized CoAs with operational maintenanceschedules to find the optimal time for applying each CoA that minimizesits interference with regular operational tasks.

In some implementations, the AgiSec platform of the present disclosureprovides tools that enable user interaction with multi-dimensional(e.g., 2D, 3D) visualizations of computational graph data and itsderived computed attributes. In some examples, topological heat maps canbe provided and represent ranks and values of the derived attributes inorder to expedite search capabilities over big data. In some examples,the tools also enable searching for key attributes of critical nodes,nodes representing CIs. In some implementations, these visualizationsare provided within a computer or immersive environment, such asaugmented reality (AR), mixed reality (MR), or virtual reality (VR). Thevisualizations of the present disclosure improve the ability of anautomated (employing contour lines) or human interactive (based onsegmented regional selection) to employ search and filteringcapabilities on big data graph topology aimed at quickly identifyingcritical nodes in the graph which its derived (computed) attributesserve as the search criteria. The attributes to be highlighted differand are configurable, as such, different contour lines appear based ondifferent criteria. In some examples, the perceived importance of anattribute relative to other attributes can be controlled in view of ascenario, vertical importance, or any domain-specific consideration,through weighed attributes. Further, similar contour lines can beidentified in other nearby nodes on the graph. For an immersivevisualization experience, matching leading contour lines can show hiddenpaths, or pattern of similar geometric shape and form, hence driveimproved comprehension for humans.

In the context of cyber security, a critical node, also referred toherein as cardinal node, can represent a CI that is a key junction forlateral movements within a segmented network. Namely, once acquired as atarget, the cardinal node can trigger multiple new attack vectors.Cardinal nodes can also be referred to as “cardinal faucet nodes.”Another node will be one that many hackers' lateral movements can reach,yet it cannot lead to an additional node. Such nodes can be referred toas “cardinal sink nodes.” In the network graph, the more edges from acardinal faucet node to other nodes, the higher the faucet attribute is.The more incoming edges to a cardinal node, the higher the sinkattribute is. If a node has both sink and faucet values in correlation,the more overall cardinal this node becomes to the entire examined graphtopology and is defined as a critical target to be acquired since itprovides control over multiple nodes in the graphs. In certainsituations, the search for a faucet attribute is more important than asink attribute. Such as a case of finding what node to block first toprevent a segregation of an attack outbreak. In case of finding what isvery hard to protect, the more sink attributes matter more.

FIG. 3 depicts an example portion 300 of an AG in accordance withimplementations of the present disclosure. In some implementations, anAG is provided based on the network topology of the enterprise network.For example, the AgiHack service 208 of FIG. 2 can generate one or moreAGs based on information provided from the AgiDis service 214. In someexamples, an AG includes nodes and edges (also referred to as arches)between nodes. In some examples, a node can be associated with asemantic type. In the example domain of cyber-security and networktopology, example semantic types can include, without limitation,computer 302, user 304, file 306, and key 308.

In some examples, an edge can include an incoming (sink) edge (e.g., anedge leading into a node from another node) or an outgoing (faucet) edge(e.g., an edge leading from a node to another node). In some examples,each edge can be associated with a respective activity. In the exampledomain of cyber-security and network topology, example activities caninclude, without limitation, logon (credentials), operating systemaccess, and memory access. In some examples, each edge can be associatedwith a respective weight. In some examples, the weight of an edge can bedetermined based on one or more features of the edge. Example featurescan include a traffic bandwidth of the edge (e.g., how much networktraffic can travel along the edge), a speed of the edge (e.g., howquickly traffic can travel from one node to another node along theedge), a difficulty to use the edge (e.g., network configurationrequired to use the edge), and a cost to use the edge (e.g., in terms oftechnical resources, or financial cost). In some examples, and asdescribed in further detail below, the weights of the edges aredetermined relative to each other (e.g., are normalized to 1).

In some implementations, each node can be associated with a set ofattributes. Example attributes can include, without limitation, thesemantic type of the node, a number of incoming edges, a number ofoutgoing edges, a type of each of the edges, a weight of each of theedges, and the like. In some implementations, one or more values for anode can be determined based on the set of attributes of the node, asdescribed in further detail herein.

The example portion 300 of the AG includes tens of nodes (approximately70 nodes in the example of FIG. 3). It is contemplated, however, that anAG can include hundreds, or thousands of nodes. In some examples, theexample portion 300 of the AG is a visualization of part of the AG basedon one or more filter parameters. In some examples, a user can definefilter parameters that can be used to identify cardinal nodes within anAG, and segments of the AG that may be relevant to a cardinal node. Inthe example of FIG. 3, a node 320 can be determined to be a cardinalnode based on one or more filter parameters (e.g., no outgoing edges,and more than three incoming edges). In some examples, other depictednodes include nodes along lateral paths that lead to a cardinal node.

In the example of FIG. 3, the node 320 can represent administratorcredentials, a relatively high-value target within an enterprisenetwork, and all other edges and nodes define the paths within the AGthat lead to the node 320. While the AG can include hundreds, orthousands of nodes and edges, the example portion 300 is provided basedon identification of the node 320 as the cardinal node (e.g., based onfilter parameters) and all paths of the AG that lead to the node 320. Inthis manner, the portion 320 provides a more easily consumablevisualization than depicting an entirety of the AG.

In some implementations, other nodes besides the cardinal node can beidentified as relatively important nodes (e.g., relative to otherdepicted nodes). In some examples, the relative importance of a node canbe determined based on attack paths that lead to a cardinal node. In theexample of FIG. 3, a node 322 can be determined to be a relativelyimportant node. Starting from the node 322, there is a single attackpath to the node 320. However, there are approximately ten differentattack paths that the node 322 is included in. Consequently, securityresources could be concentrated on the node 322, as opposed to nodesupstream of the node 322 in the multiple attack paths. In this manner,security resources can more efficiently protect the node 320, asdescribed in further detail herein.

Further, AGs can change over time. That is, there is a multi-dimensionalaspect to AGs with one dimension including time. For example, and withcontinued reference to the example of FIG. 3, the node 320 can beconsidered a cardinal node based on the filter parameters. At anothertime, the node 320 might no longer be considered a cardinal node. Forexample, between the first time and the second time, values ofattributes may have changed for nodes, some nodes may have been removedfrom the network (e.g., computers retired, users removed), and/or somenodes may have been added to the network (e.g., new computers/users).

As introduced above, implementations of the present disclosure providefor prioritization of actions for remediation of cyber attacks based onlateral movements of a malicious user within a network. Moreparticularly, and as described in further detail herein, implementationsof the present disclosure consider the ability of malicious users toaccess supporting CIs from the network through lateral movements andestimate which attack path should be handled first in order to prevent acomprised CI. In some implementations, a relative importance andcomplexity of an attack path are determined and cyber actions to blockaccessing a CI are prioritized. In this manner, cyber actions areefficiently implemented to prevent damage and reduce the attack surfaceand internals of the network, gradually increasing the entire networkcyber resilience.

FIG. 4 depicts a conceptual diagram 400 for cyber-attack riskcalculation in accordance with implementations of the presentdisclosure. In some implementations, a system that provides value and iscontrolled by an enterprise is denoted as Sys, and a process is denotedas BP. In some examples, one or more processes can support a singlesystem. In some examples, N is the total number of BPs that can supporta system. A system includes at least one BP, namely:

N={1,2, . . . n}∈

₁  (1)

As described above, a configuration item (CI) is a physical IT/OTelement, or a logical IT/OT element, that is part of one or more BPs. Inthe area of cyber security, a target CI to be compromised can bereferred to as a crown jewel. An example crown jewel that is a logicalCI is the network administration credentials. An example crown jewelthat is a physical CI can be a web server. An example for a pure logicalBP can be referred to as a cyber administrator that has only onesupporting logical CI, which is the administration credentials. Anexample of a pure physical BP can include boiler activation that hasonly one supporting physical CI, which is a supervisory control and dataacquisition (SCADA) controller, a programmable logic controller (PLC),or a human-machine interface (HMI) access.

In some examples, there are a set of M CIs in a Sys, namely:

M={1,2 . . . m}∈

₁  (2)

A subset of CIs that is part of the entire set of CIs of the system andsupports a single process n (BP_(n)), is denoted as K_(n) namely:

K _(n) ⊆M  (3)

The relative normalized contribution of a supporting entity CI_(k) on acompound outcome is denoted as CI_(Weightk,n) and defined as theproportional contribution in percentage of a CI_(k) to a successfuloutcome of the process BP_(n). In services, a supporting CI_(k) can alsobe single point of failure to the entire BP_(n), hence, the normalizedweighted contribution of each CI_(Weightk,n) can be maximizedaccordingly to:

CI_(Weightk,n)≤100%, k∈K _(n)  (4)

In cases where compromising or degradation of performance of any of thesupporting CI_(k) does not bring the entire BP_(n) to a halt, theoverall weights should be normalized. For example:

Σ_(i=1) ^(k)CI_(Weightk,n)=100%, k∈K _(n)  (5)

Default allocation of supporting weights of CI_(k) to a BP_(n) in caseswhere no prior knowledge of relative contribution is known can beuniformly provided either as:

$\begin{matrix}{{CI}_{{Weighti},n} = \frac{1}{k}} & (6)\end{matrix}$

to indicated relative contribution, or as:

CI_(Weighti,n)=100%  (7)

to indicate that each CI is a single point of failure, or anycombination of both of the above relationships.

FIG. 4 depicts the entity relations in constructing accumulated riskestimation and resulting impact of misfunctioning or degradation inperformance of a CI_(m) on multiple supported BP_(n)s. In some examples,the degradation of performance can be driven by several cyber issuesdenoted as IS_(ML) that are associated with a single CI_(m) with arelative issue number. The issues are driven by existing vulnerabilitiesthat can be exploited and denoted as Vuln_(v). Each documentedvulnerability Vuln_(v) can affect one or more issues IS_(ML), and eachissue IS_(ML) affects a single associated CI_(m).

A tangible risk to a full BP_(n) is driven by a set of CI_(m) thatsupport the BP_(n) and can be compromised, because they contain one ormore cyber issues. However, not all CI_(m) have cyber issues and henceare less likely to be compromised. In some examples, CI_(m) that do nothave issues will be considered healthy and will not be part of the riskcalculation.

In a single CI_(m) cyber issues are ranked in terms of risk severity tohigh, medium and low, in which high severity is defined as an easiereffort to compromise a CI_(m). As such, in cases where several issuesexist in a single CI_(m), eliminating the higher risk issues first isprioritized over attending to lower severity issues. As long as thereare IS_(ML) on a CI_(m), the CI_(Weightk,n) value will be considered inthe overall risk evaluation for a supported BP_(n) as defined below.

In addition, if, within the set of CI_(m) that support the BP_(n), acertain CI_(m) has a value of CI_(Weightk,n)=100%, its issues should beremediated first prior to other CI_(m). Once such cases are eliminated,the component prioritizes the rest of the CI_(m) to be handled accordingto the ones with the highest CI_(Weightk,n) value. As such, the initialrisk to a BP_(n) is defined as:

$\begin{matrix}{{{Initial\_ BPRisk}_{n} = \begin{Bmatrix}\Sigma_{i \in K_{n}} & {{CI}_{{Weighti},n},{{for}\mspace{14mu} A}} \\{100\%} & {,{{for}\mspace{14mu} B}} \\\; & {{{where}\mspace{14mu}{\forall{IS}_{{ML}{({i,n})}}}} = \varnothing}\end{Bmatrix}}{{A\text{:}{where}\mspace{14mu}{\forall{{CI}_{{Weighti},n}\mspace{14mu}{\nexists\mspace{14mu}{CI}_{{Weighti},n}}}}} = {100\%}}{{{B\text{:}{where}\mspace{14mu}{\forall{{CI}_{{Weighti},n}\mspace{14mu}{\exists\mspace{14mu}{{one}\mspace{14mu}{CI}}}}}}❘{CI}_{{Weighti},n}} = {100\%}}} & (7)\end{matrix}$

In the notation above, A indicates a scenario, in which compromise ofany particular CI_(m) would not lead to a total failure of the BP_(n)(e.g., the BP_(n) is degraded, but does not fail when CI_(m) iscompromised). In the notation above, B indicates a scenario, in whichcompromise of a particular CI_(m) would lead to a total failure of theBP_(n) (e.g., the BP_(n) fails when CI_(m) is compromised). In such ascenario, a sum of CI_(Weightk,n) values can exceed 100% (e.g.,compromise of CI₁ results in total failure of the BP, and compromise ofCI₂ results in degradation, but not failure, of the BP).

Denoting BPV_(n) as the total value of a BP_(n) (e.g., in terms ofeconomics, proportional importance to the system, technical resources ofthe system), the impact of a single CI indexed as i that supports BP_(n)and has vulnerabilities and issues is defined as:

CImpact_(i,n)=CI_(Weighti,n)*BPV_(n)  (8)

The overall business impact risk on the entire BP_(n) is defined as:

BImpact_(n)=BPV_(n)*Initial_BPRisk_(n)  (9)

Combing Equations (7) and (9) implies that, in case there is a CI_(m)with a CI_(weight)=100%, the impact on the BP_(n) is maximum and will beequal to BPV_(n). Consequently, the initial risk impact of each of thesupporting CI on the entire system as a whole is provided as:

$\begin{matrix}{{SySImpact}_{{CI}{(m)}} = \frac{\sum\limits_{j = 1}^{N}\;{CImpact}_{m,j}}{\sum\limits_{n = 1}^{N}\;{BPV}_{n}}} & (10)\end{matrix}$

where m∈M.

FIG. 5 depicts an example portion 500 of an AG to illustrateimplementations of the present disclosure. The example portion 500 is ofan AG that is generated for a process 502. In the depicted example, theprocess 502 is supported by configuration items 504, 506, 508, 510having respective proportional impacts on the process 502. Theconfiguration items 504, 506, 508, 510 are considered exploitable, andare therefore included in the AG. Although other configuration items cansupport the process 500, they are non-exploitable, and are therefore notincluded in the AG.

As depicted in FIG. 5, the example portion 500 includes PLCs (CIs 504,506), a remote terminal unit (RTU) (CI 508), and a HMI (CI 510) that arepart of a larger set of CIs that directly control the BP 502 and theirfailure would result failure of the BP 502. The total contribution ofsupporting CIs is 100%, of which only the displayed CIs 504, 506, 508,510 can be compromised with the total proportional impact on risk of85%. As depicted in FIG. 5, only potentially exploitable CIs appear onthe AG. There are other CIs that do not directly control the BP 502 andcan be displayed on the AG due to security issues and possible attackpaths from them to the CIs supporting the BP. For example, a remote user(e.g., over the Internet) may exploit a vulnerability on a corporate ITserver and perform a lateral move to the HMI, which impacts the entireBP 502 by 45%.

Implementations of the present disclosure also provide prioritization ofactions for remediations of cyber-attacks. As described in furtherdetail herein, prioritization is based on an AG that includes nodesrepresenting CIs within a network. In some examples, after the impact ofeach CI on the entire system is calculated, all adversarial lateralmovements that can progress toward CIs that are part of a BP of theentire Sys are explored. In some examples, a logical AG that includespotential attack paths from any given asset in the network to the CIsand to all processes.

Activity of a malicious user (hacker) within the network represented bythe AG can be indicated as Action. A lateral movement complexity(LMC_(ij)) describes a lateral movement Action between two nodes on theAG denoted as i (a source CI) and j (a destination CI). Accordingly, thefollowing example relationship can be provided:

LMC_(i,j)=LMC_(CI(i)→CI(j))  (11)

where i,j∈M. A lateral movement path (LMP_(ab)) is defined as a set of alinked list data structure of LMC_(i,j) as:

LMP_(ab)=LMC_(a,j)∪LMC_(j,b)  (12)

where j,a,b∈M, and j is index for any node in the path from source a todestination b excluding nodes a and b.

In some implementations, a complexity value (LMCV_(ij)) is assigned toevery LMC_(i,j), in which a low value (e.g., 1) represents an easiestAction complexity to perform and a high value (e.g., 9) is the mostdifficult Action to perform for a single LMC_(i,j) arch (edge) in an AG.For example:

LMCV_(i,j)∈{1,2, . . . 9}∈

₁  (13)

In some examples, the complexity value (LMCV_(ij)) is provided from athreat intelligence service. For example, the threat intelligenceservice can provide scores (complexity value) for types of lateralmovements.

In some implementations, a preconditioned action (ActionCV) is performedprior to a specific Action. In some examples, ActionCV is not sequentialin nature and can be repetitive and iterative on the same node and CI,hence not necessarily on a path p. In some implementations, a complexityvalue (LMPV_(a,b,p)) of a path p of a lateral movement LMP_(a,b) (whichcan include multiple sets of LMP_(a,b)) is provided as:

LMPV_(a,b,p)=Σ_(i=a) ^(b−1)LMCV_(i,i+1)+Σ_(j=1)^(q)ActionCV_(i,i+1)  (14)

where ∇LMCV_(i,i+1)=[1 . . . 9], q=|ActionCV| and p∈{pab1, pab2, pab3 .. . pab_(t))∈P. Here, P is the set of all possible paths (pab_(t)) and apath (p) is provided between nodes a and b that are sequentially orderedand linked.

In some examples, b nodes are defined as part of K_(b) crown jewels(targets), which are the set of supporting CI_(k)s for the processBP_(n) that can be compromised and have issues IS_(ML). A set of entrynodes Y is provided and includes nodes a that can reach a target node b(crown jewel). Such a crown jewel (e.g., administrator credentials) canbe referred to as a target and denoted as CI_(k). In accordance withimplementations of the present disclosure, LMPV_(a,b,p) is determinedfor all nodes b based on the following example algorithm:

Algorithm 1 [1] ∀b ∈ K_(n) ∈ M [2] ∀a ∈ Y ∈ M [3] Compute LMPV_(a,b,p)[4] Next a [5] Next b

FIG. 6 depicts an example of determining complexity of attack paths inaccordance with implementations of the present disclosure. The exampleof FIG. 6 includes an example portion 600 of an AG that includes nodes602, 604, 606, 608, 610, 612, 614 representing CIs within a network. Inthe example of FIG. 6, a first path 620 from the node 602 to the node610, and a second path 622 from the node 602 to the node 610. Thecomplexity for each path 620, 622 is calculated based on Algorithm 1,above. As depicted in FIG. 6, the path 620 includes an ActionCV, whilethe path 622 does not. As such, the complexity value LMPV_(a,b,p) of thepath 622 is 8 (e.g., ai+ij+jb, with values of 1, 5, and 2, respectively)and the complexity value LMPV_(a,b,p) of the path 620 is 26 (with valuesof 2, 4, 3, 9, 8, respectively). In the example of FIG. 6, the node 614can be considered divergent, because multiple paths (path segments) stemfrom the node 614. Accordingly, the node 614, as divergent, provides apivot point for an attacker, which can attack along optional paths. Inthe example of FIG. 6, the node 608 can be considered convergent,because multiple paths (path segment) lead to the node 608. Accordingly,the node 608 may be easier to attack (e.g., laterally move to), becausethere are more paths that lead to the node 608.

In accordance with implementations of the present disclosure, probableattack paths that an attacker may take towards a given target can bedetermined based on complexity values of the respective attack paths(e.g., as depicted by way of example in FIG. 6). Remediationrequirements can be determined, which can be implemented to avoid anattack along the identified attack paths. In some examples, aremediation requirement describes what vulnerability is to be fixed suchthat a potential hacker will not be able to perform a lateral movementbetween two sequential CIs on an attack path, thereby terminating theability to acquire a target on the path. As the resources forimplementing security requirements are limited, implementations of thepresent disclosure prioritize remediation requirements based on theireffectiveness in reducing risk with minimum resources and minimalefforts. Such remediation requirements are more complex in industrialenvironments due to operational constraints (e.g., a PLC's firmwarecannot be patched, because it may interrupt a critical; an HMI'soperating system cannot be upgraded, because it may interfere withreal-time network traffic in the OT environment and cause a delay in aservice). Consequently, and as described in further detail herein,multiple criteria are considered in prioritizing remediationrequirements. Example criteria include, without limitation, remediationflexibility, likelihood and complexity of the attack due to the level ofneeded threat actors, and overall impact.

In some implementations, an initial risk (Initial_BPRisk_(n)) can beprovided as the percentage of risk to a BP_(n) due to a set ofcompromised crown jewels (CI_(k)), namely, all of the nodes b that canbe compromised according to an AG and that belong to the BP_(n). In someexamples, Initial_BPRisk_(n) is the percentage of risk manifestationassociated with a certain BP_(n), which is further allocatedproportionally to its supporting CI_(k). Namely, all nodes b that can becomprised according to an AG and that belong to a single BP_(n). As longas a CI_(k) target can be reached through lateral movements, theproportional contribution of that target to the overallInitial_BPRisk_(n) remains relevant. That is, if a CI_(k) can becompromised, the risk contribution to the overall Initial_BPRisk_(n)remains the same. In some implementations, a proposed remediation(REM_(VR(i))) is provided out of a set of g remediation requirementsthat are possible for each issue IS_(ML) caused by a vulnerabilityVuln_(vs), such that:

∇IS _(ML(l))∃REM_(VR(i)) , i∈{1, . . . g}  (15)

In some implementations, a cost function (CostRem_(vr)) is associatedwith each REM_(VR(i)) that can resolve a single IS_(ML), such that:

∇REM_(VR(i))∃CostRem_(VR(i)) , i∈{1, . . . g}  (16)

In accordance with implementations of the present disclosure, all of theissues that needed to be remediated for a BP_(n) to reduce the riskthereto are prioritized based on the following 1) prioritized target'simportance; 2) easiest attack path or easiest attack segment; and 3)relative risk remediation contribution of the same CI to otherprocesses. Algorithm 2, below, provides the remediation process:

Algorithm 2  [1] ∀b ∈ K_(n) ∈ M , where K_(n) is ordered from highestCI_(Weight(b,n)) value supporting BP_(n)  [2]  ∀p ∈ P_(b), where P pathsto b, are ordered by lowest LMPV_(a,b,p) values  [3]   ∀node_(m) ∈ p,where the nodes on p are ordered by lowest LMCV_(i,j) values or lowestCostRem_(vr)  [4]    Print (display/present) IS_(ML) and its set ofREM_(VR) and CI_(Weight(b,n))  [5]    If node_(m) ∈ BP_(w), where w ≠ n, present impact on Sys  [6]     Present REM_(VR) and CI_(Weight(b,n)) [7]     (option) Compute SySImpact_(CI(m))  [8]    End if  [9]   Nextnode [10]  next p [11] next b

In Algorithm 2, for a given BP, every supporting CI starting with thehighest impact CIs, and all of the active easiest attack paths to thoseCIs are examined. As such, the overall attack surface is hardened, byincrementally removing attack paths, if acting on the prioritizedrequirements. Once all attack paths to a target node b are removed, theproportional risk contribution of that node can be subtracted from theoverall risk likelihood, reducing the overall likelihood of riskmanifestation.

In some implementations, a convergent value can be determined for eachnode j in an attack path p for a BP_(n) (where n∈N), andSySImpact_(CI(m)) is determined for each node (CI_(m)) on the attackpath (where m∈K). In some examples, a Covergent_Val for a node j isprovided as the count of all LMCV_(i,j) that enters j, where i can beany dispatching node in K. For example:

Convergent_Val_(j)=|LMC_(i,j)|  (17)

where i∈K and ∇LMCV_(j,i)>1. In some implementations, a divergent valuecan be determined for each node i in the attack path p. In someexamples, Divergent_Val for a node i is provided as the count of allLMC_(i,j) arches that exit the node i, where j can be any destinationnode in K. For example:

Divergent_Val_(j)=|LMC_(i,j)|  (18)

where j∈K and 59 LMCV_(j,i)>1.

In some implementations, all Convergent_Val_(k) and Divergent_Val_(k)for each node (CI_(k)) in K are determined. In some examples, a nodeCI_(k) having a maximum Divergnet_Val_(k) is designated as the mostdivergent factor in the system. For example:

MaxDivergent=max(Divergent_Val_(k))  (19)

where sV k∈K. In some examples, a node CI_(k) having a maximumConvergent_Val_(k) is designated as the most convergent factor in thesystem. For example:

MaxCovergnet=max(Covergent_(Valk))  (20)

where ∇k∈K. In some implementations, a transformative vector is providedas a combination of convergent and divergent values for each CI_(k)based on the following example relationship:

Transformative_(k)=Divergent_(Valk)+Covergent_Val_(k)  (21)

where Vk∈K. In some implementations, a list of CI_(k)s in Sys are sortedto either convergent, transformative, or divergent nodes and theirrespective values on SySImpact_(CI(m)) are provided.

In some implementations, an ordered list of remediations is provided.For example, and as described herein, a set of BP_(n) containing CI_(k)that has a set of attack paths P that contain issues IS_(ML) withREM_(VR) and associated cost can be defined. A risk reduction can bedefined as employing a remediation REM_(VR) to an issue IS_(ML), whichwill disable the ability to transverse on a path p (i.e., disconnect thepath). A gradual risk reduction can be provided as employing orderedremediation according to multiple modes. Example modes include adivergent mode, a convergent mode, a less costly mode, and a mostprobable mode. In some examples, in the divergent mode, for a node i,remediations are performed on the node i+1 that is connected to the exitarches. In some examples, in the convergent mode, the remediations areperformed on the node i that has incoming multiple arches. In someexamples, in the less costly mode, for the path p with the lowestLMPV_(a,b,p) value, remediations that have the lowest cost CostRem_(vr)value are prioritized. In some examples, in the most probable mode, forthe path p with the lowest LMPV_(a,b,p) value, remediations that areassociated with issues IS_(ML) that can prevent a lateral movementLMC_(i,j) and that the lowest complexity LMCV_(i,j) value areprioritized.

It can be noted that, once a path has an associated remediationresolved, the path is no longer part of the set of P possible pathsacross all Sys. Consequently, the next lowest LMPV_(a,b,p) is attendedto.

As described in detail herein, a flow of interactions can be performedthrough the AgiSec platform of the present disclosure to provide an AG,such as the AG having the example portion 500 depicted in FIG. 5. Forexample, the AgiSec platform discovers and retrieves a list of IT and OTassets (CIs) and captures the network topology. The AgiSec platformindicates how the discovered CIs are mapped to processes and services.That is, which CI supports which process and what is its proportionalcontribution to that process is (e.g., as depicted by way of example inFIG. 5). As such, the AgiSec platform provides insights into theprocesses topology of an enterprise and can be used to analyze thedependency structure of IT/OT for other usages. This topologicalstructure is constructed with AgiDis and AgiBuiz modules, as describedherein.

In accordance with implementations of the present disclosure, the AgiSecplatform extracts a list of specific vulnerabilities for every CI thatis based on adversarial tactics (e.g., MITRE) or attack tactics uniqueto the enterprise created by security experts. In parallel, the AgiSecplatform extracts the associated threat intelligence from catalogedrepositories in order to create the intelligence contextual mapping ofeach of the investigated CIs, which is referred to ContextualIntelligence. The AgiSec platform further investigates the discoveredCIs for additional information that can be used to compromise the CI s.Examples include, without limitation, open network sessions, in-memorycredentials, open ports, administration batch files, and the like. Thisis accomplished by AgiDis and AgiInt modules, as described herein.

After the discovered vulnerabilities and potential exploitations areaccumulated from the threat intelligence feeds, the AgiSec platformsimulates all possible attack paths and attack actions as a virtualadversary. The simulated virtual adversary analytics is conducted on adedicated server, creating a model of lateral movement topology of theexamined environment, and representing a logical analysis of adversarialpotential lateral movements. This comprehensive view for all potentialattacks on all target CIs and hence on all processes, is used togenerate the AG. This analysis is performed at the AgiHack module, asdescribed herein.

The AgiSec platform analyzes the AG topology in detail and uses threatintelligence feeds to determine remediation requirements options. Whenapplied, the AgiSec platform performs a what-if analysis for predictingthe efficiency of security remediation requirements according to riskreduction in accordance with implementations of the present disclosure.These actions are performed by the AgiRem module, as described herein.After the AgiSec platform completes the scan, a prioritized requirementsworkplan is generated as described herein, and is sent to externalSecurity Operation Center (SOC) tools to be handled. Consequently, whennotified of completion, AgiPro verifies the quality of theimplementation, updates the simulated virtual adversary AG, andrecalculates the associated risks. As described herein, the AgiSecplatform determines the recommended risk reduction and monetization orproportional evaluation, according to the following prioritization: 1)selection of the process with the highest monetized risk; 2) selectionof the highest-value critical asset within the process; 3) examinationof the easiest attack path to the above critical asset; and 4)recommending a fix to the easiest segment in the easiest attack path andthe cost of employing such remediation.

FIG. 7 depicts an example process 700 that can be executed in accordancewith implementations of the present disclosure. In some implementations,the example process 700 may be performed using one or morecomputer-executable programs executed using one or more computingdevices. The example process 700 can be performed for cyber-attack riskdetermination in accordance with implementations of the presentdisclosure.

Graph data is received (702). For example, the AgiHack service 208receives graph data from the AgiDis service 214 of FIG. 2. In someexamples, and as described in detail herein, the graph data defines agraph that is representative of an enterprise network. A graph isgenerated (704). In some examples, and as also described in detailherein, the graph includes nodes and edges between nodes, each noderepresenting an asset within the enterprise network, and each edgerepresenting at least a portion of one or more lateral paths betweenassets in the enterprise network.

A process (BP_(n)) is identified (706). In some examples, the process isselected from a set of processes that are included in a system (Sys)(see, e.g., FIG. 4). For example, an as depicted in FIG. 5, an AG isgenerated and includes the process 502 and CIs 504, 506, 508, 510 thatsupport execution of the process 502, which is included in a system. Aset of CIs (K_(r)) is defined (708). For example, and as describedabove, K_(n) is a subset of CIs that is part of the entire set of CIs ofthe system and supports the process BP_(n).

A contribution value (CI_(Weightk,n)) is determined for each CI in theset K_(n) (710). For example, and as described herein, CI_(Weightk,n) isa normalized contribution of a supporting entity CI_(k) on a compoundoutcome. In some examples, CI_(Weightk,n) is defined as a proportionalcontribution in percentage of a CI_(k) to an outcome of the processBP_(n). In some examples, a supporting CI_(k) can be a single point offailure to the entire BP_(n), hence, CI_(Weightk,n) can be maximized(e.g., set to 100%).

An impact of each CI on the process BP_(n) is determined (712). Forexample, and as described herein, the total value of a BP_(n) (e.g., interms of economics, proportional importance to the system, technicalresources of the system) is provided as B PV_(n). In some examples,BPV_(n) is defined by the enterprise operating the Sys (e.g., theenterprise determines the impact the process BP_(n) would have ontechnical resources (e.g., loss of resources, expense of resources toreestablish the process BP_(n)). In some examples, the impact of asingle CI indexed as i that supports BP_(n) and has vulnerabilities andissues is defined as detailed in Equation 8, above. One or moreremediations are implemented based on respective impacts (714). Forexample, and as described in further detail herein, one or moreremediations can be selected based on respective impacts. In someexamples, the remediations are prioritized to achieve efficiencies inavoiding or mitigating cyber issues (e.g., efficiencies in terms ofresources, such as technical resources, expended).

FIG. 8 depicts an example process 800 that can be executed in accordancewith implementations of the present disclosure. In some implementations,the example process 800 may be performed using one or morecomputer-executable programs executed using one or more computingdevices. The example process 800 can be performed for prioritizingremediations against potential cyber-attacks based on lateral movementsin accordance with implementations of the present disclosure.

Graph data is received (802). For example, the AgiHack service 208receives graph data from the AgiDis service 214 of FIG. 2. In someexamples, and as described in detail herein, the graph data defines agraph that is representative of an enterprise network. A graph isgenerated (804). In some examples, and as also described in detailherein, the graph includes nodes and edges between nodes, each noderepresenting an asset within the enterprise network, and each edgerepresenting at least a portion of one or more lateral paths betweenassets in the enterprise network.

A process (BP_(n)) is identified (806). In some examples, the process isselected from a set of processes that are included in a system (Sys)(see, e.g., FIG. 4). For example, and as depicted in FIG. 5, an AG isgenerated and includes the process 502 and CIs 504, 506, 508, 510 thatsupport execution of the process 502, which is included in a system. Aset of CIs (K_(n)) is defined (808). For example, and as describedabove, K_(n) is a subset of CIs that is part of the entire set of CIs ofthe system and supports the process BP_(n).

A contribution value (CI_(Weightk,n)) is determined for each CI in theset K_(n) (810). For example, and as described herein, CI_(Weightk,n) isa normalized contribution of a supporting entity CI_(k) on a compoundoutcome. In some examples, CI_(Weightk,n) is defined as a proportionalcontribution in percentage of a CI_(k) to an outcome of the processBP_(n). In some examples, a supporting CI_(k) can be a single point offailure to the entire BP_(n), hence, CI_(Weightk,n) can be maximized(e.g., set to 100%).

A set of lateral movement paths is provided (812). For example, the setof lateral movement paths includes two or more lateral movement pathsbetween a first asset and a second asset within the graph (e.g., thepaths 620, 622 between the node 602 and the node 610 in FIG. 6). Foreach lateral movement path, a lateral movement path value is provided(814). As described herein, a lateral movement path value (LMPV_(a,b,p))is representative of a difficulty in traversing a respective lateralmovement path within the enterprise network.

A set of remediations is defined (816). For example, the set ofremediations is defined based on two or more remediations defined forone or more vulnerabilities associated with issues identified forrespective assets, as described herein. In some examples, eachremediation mitigates a cyber-security risk within the enterprisenetwork (e.g., as depicted in FIG. 4). Remediations are prioritized(816). For example, and as described herein, two or more remediationsare prioritized based on contribution values of assets, lateral movementpath values of paths, and one of lateral movement complexity values ofrespective segments of paths and costs of respective remediations. Forexample, the remediations are prioritized as described above withreference to Algorithm 2.

Implementations and all of the functional operations described in thisspecification may be realized in digital electronic circuitry, or incomputer software, firmware, or hardware, including the structuresdisclosed in this specification and their structural equivalents, or incombinations of one or more of them. Implementations may be realized asone or more computer program products, i.e., one or more modules ofcomputer program instructions encoded on a computer readable medium forexecution by, or to control the operation of, data processing apparatus.The computer readable medium may be a machine-readable storage device, amachine-readable storage substrate, a memory device, a composition ofmatter effecting a machine-readable propagated signal, or a combinationof one or more of them. The term “computing system” encompasses allapparatus, devices, and machines for processing data, including by wayof example a programmable processor, a computer, or multiple processorsor computers. The apparatus may include, in addition to hardware, codethat creates an execution environment for the computer program inquestion (e.g., code) that constitutes processor firmware, a protocolstack, a database management system, an operating system, or acombination of one or more of them. A propagated signal is anartificially generated signal (e.g., a machine-generated electrical,optical, or electromagnetic signal) that is generated to encodeinformation for transmission to suitable receiver apparatus.

A computer program (also known as a program, software, softwareapplication, script, or code) may be written in any appropriate form ofprogramming language, including compiled or interpreted languages, andit may be deployed in any appropriate form, including as a stand aloneprogram or as a module, component, subroutine, or other unit suitablefor use in a computing environment. A computer program does notnecessarily correspond to a file in a file system. A program may bestored in a portion of a file that holds other programs or data (e.g.,one or more scripts stored in a markup language document), in a singlefile dedicated to the program in question, or in multiple coordinatedfiles (e.g., files that store one or more modules, sub programs, orportions of code). A computer program may be deployed to be executed onone computer or on multiple computers that are located at one site ordistributed across multiple sites and interconnected by a communicationnetwork.

The processes and logic flows described in this specification may beperformed by one or more programmable processors executing one or morecomputer programs to perform functions by operating on input data andgenerating output. The processes and logic flows may also be performedby, and apparatus may also be implemented as, special purpose logiccircuitry (e.g., an FPGA (field programmable gate array) or an ASIC(application specific integrated circuit)).

Processors suitable for the execution of a computer program include, byway of example, both general and special purpose microprocessors, andany one or more processors of any appropriate kind of digital computer.Generally, a processor will receive instructions and data from a readonly memory or a random access memory or both. Elements of a computercan include a processor for performing instructions and one or morememory devices for storing instructions and data. Generally, a computerwill also include, or be operatively coupled to receive data from ortransfer data to, or both, one or more mass storage devices for storingdata (e.g., magnetic, magneto optical disks, or optical disks). However,a computer need not have such devices. Moreover, a computer may beembedded in another device (e.g., a mobile telephone, a personal digitalassistant (PDA), a mobile audio player, a Global Positioning System(GPS) receiver). Computer readable media suitable for storing computerprogram instructions and data include all forms of non-volatile memory,media and memory devices, including by way of example semiconductormemory devices (e.g., EPROM, EEPROM, and flash memory devices); magneticdisks (e.g., internal hard disks or removable disks); magneto opticaldisks; and CD ROM and DVD-ROM disks. The processor and the memory may besupplemented by, or incorporated in, special purpose logic circuitry.

To provide for interaction with a user, implementations may be realizedon a computer having a display device (e.g., a CRT (cathode ray tube),LCD (liquid crystal display), LED (light-emitting diode) monitor, fordisplaying information to the user and a keyboard and a pointing device(e.g., a mouse or a trackball), by which the user may provide input tothe computer. Other kinds of devices may be used to provide forinteraction with a user as well; for example, feedback provided to theuser may be any appropriate form of sensory feedback (e.g., visualfeedback, auditory feedback, or tactile feedback); and input from theuser may be received in any appropriate form, including acoustic,speech, or tactile input.

Implementations may be realized in a computing system that includes aback end component (e.g., as a data server), or that includes amiddleware component (e.g., an application server), or that includes afront end component (e.g., a client computer having a graphical userinterface or a Web browser through which a user may interact with animplementation), or any appropriate combination of one or more such backend, middleware, or front end components. The components of the systemmay be interconnected by any appropriate form or medium of digital datacommunication (e.g., a communication network). Examples of communicationnetworks include a local area network (“LAN”) and a wide area network(“WAN”) (e.g., the Internet).

The computing system may include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client-server relationship to each other.

While this specification contains many specifics, these should not beconstrued as limitations on the scope of the disclosure or of what maybe claimed, but rather as descriptions of features specific toparticular implementations. Certain features that are described in thisspecification in the context of separate implementations may also beimplemented in combination in a single implementation. Conversely,various features that are described in the context of a singleimplementation may also be implemented in multiple implementationsseparately or in any suitable sub-combination. Moreover, althoughfeatures may be described above as acting in certain combinations andeven initially claimed as such, one or more features from a claimedcombination may in some cases be excised from the combination, and theclaimed combination may be directed to a sub-combination or variation ofa sub-combination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed in the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various systemcomponents in the implementations described above should not beunderstood as requiring such separation in all implementations, and itshould be understood that the described program components and systemsmay generally be integrated together in a single software product orpackaged into multiple software products.

A number of implementations have been described. Nevertheless, it willbe understood that various modifications may be made without departingfrom the spirit and scope of the disclosure. For example, various formsof the flows shown above may be used, with steps re-ordered, added, orremoved. Accordingly, other implementations are within the scope of thefollowing claims.

1.-27. (canceled)
 28. A computer-implemented method for prioritizingremediations in systems of an enterprise, the method being executed byone or more processors and comprising: providing, by a securityplatform, graph data defining a graph that is representative of assetsand relationships between assets that execute a process within anenterprise network; determining two or more lateral movements pathsbetween a first asset and a second asset within the graph; providing,for each lateral movement path, a lateral movement path valuerepresentative of a difficulty in traversing the lateral movement path;identifying a set of remediations based on two or more remediationsdefined for one or more vulnerabilities associated with respectiveassets, each remediation mitigating a cyber-security risk within theenterprise network; and prioritizing the two or more remediations basedon contribution values of assets, lateral movement path values of paths,and one of lateral movement complexity values of respective segments ofpaths and costs of respective remediations, each contribution valueindicating a contribution of a respective asset to operation of theprocess.
 29. The method of claim 28, wherein each lateral movement pathvalue is determined based on at least one lateral movement complexityvalue and a preconditioned action.
 30. The method of claim 29, whereinthe preconditioned action is performed before a lateral movement actionof an attacked can be executed within the enterprise network.
 31. Themethod of claim 28, wherein each segment represents a lateral movementbetween a first node and a second node within the graph.
 32. The methodof claim 28, wherein after a path is remediated, a next path is selectedbased on lateral movement path value and remediations arere-prioritized.
 33. The method of claim 28, wherein the graph isgenerated by a discovery service, the discovery service detecting assetsusing one or more adaptors and respective asset discovery tools thatgenerate an asset inventory and a network map of the enterprise network.34. The method of claim 28, wherein each asset is identified as a targetwithin the enterprise network, the target being selected based on adisruption occurring in response to an attack on the target.
 35. Themethod of claim 34, wherein the disruption is based on one or moremetrics.
 36. The method of claim 35, wherein the one or more metricscomprise loss of technical resources, physical losses, disruption inservices, and financial losses.
 37. A non-transitory computer-readablestorage medium coupled to one or more processors and having instructionsstored thereon which, when executed by the one or more processors, causethe one or more processors to perform operations for prioritizingremediations in systems of an enterprise, the operations comprising:providing, by a security platform, graph data defining a graph that isrepresentative of assets and relationships between assets that execute aprocess within an enterprise network; determining two or more lateralmovements paths between a first asset and a second asset within thegraph; providing, for each lateral movement path, a lateral movementpath value representative of a difficulty in traversing the lateralmovement path; identifying a set of remediations based on two or moreremediations defined for one or more vulnerabilities associated withrespective assets, each remediation mitigating a cyber-security riskwithin the enterprise network; and prioritizing the two or moreremediations based on contribution values of assets, lateral movementpath values of paths, and one of lateral movement complexity values ofrespective segments of paths and costs of respective remediations, eachcontribution value indicating a contribution of a respective asset tooperation of the process.
 38. The computer-readable storage medium ofclaim 37, wherein each lateral movement path value is determined basedon at least one lateral movement complexity value and a preconditionedaction.
 39. The computer-readable storage medium of claim 38, whereinthe preconditioned action is performed before a lateral movement actionof an attacked can be executed within the enterprise network.
 40. Thecomputer-readable storage medium of claim 37, wherein each segmentrepresents a lateral movement between a first node and a second nodewithin the graph.
 41. The computer-readable storage medium of claim 37,wherein after a path is remediated, a next path is selected based onlateral movement path value and remediations are re-prioritized.
 42. Thecomputer-readable storage medium of claim 37, wherein the graph isgenerated by a discovery service, the discovery service detecting assetsusing one or more adaptors and respective asset discovery tools thatgenerate an asset inventory and a network map of the enterprise network.43. The computer-readable storage medium of claim 37, wherein each assetis identified as a target within the enterprise network, the targetbeing selected based on a disruption occurring in response to an attackon the target.
 44. The computer-readable storage medium of claim 43,wherein the disruption is based on one or more metrics.
 45. Thecomputer-readable storage medium of claim 44, wherein the one or moremetrics comprise loss of technical resources, physical losses,disruption in services, and financial losses.
 46. A system, comprising:one or more computers; and a computer-readable storage device coupled tothe computing device and having instructions stored thereon which, whenexecuted by the computing device, cause the computing device to performoperations for prioritizing remediations in systems of an enterprise,the operations comprising: providing, by a security platform, graph datadefining a graph that is representative of assets and relationshipsbetween assets that execute a process within an enterprise network;determining two or more lateral movements paths between a first assetand a second asset within the graph; providing, for each lateralmovement path, a lateral movement path value representative of adifficulty in traversing the lateral movement path; identifying a set ofremediations based on two or more remediations defined for one or morevulnerabilities associated with respective assets, each remediationmitigating a cyber-security risk within the enterprise network; andprioritizing the two or more remediations based on contribution valuesof assets, lateral movement path values of paths, and one of lateralmovement complexity values of respective segments of paths and costs ofrespective remediations, each contribution value indicating acontribution of a respective asset to operation of the process.
 47. Thesystem of claim 46, wherein each lateral movement path value isdetermined based on at least one lateral movement complexity value and apreconditioned action.
 48. The system of claim 47, wherein thepreconditioned action is performed before a lateral movement action ofan attacked can be executed within the enterprise network.
 49. Thesystem of claim 46, wherein each segment represents a lateral movementbetween a first node and a second node within the graph.
 50. The systemof claim 46, wherein after a path is remediated, a next path is selectedbased on lateral movement path value and remediations arere-prioritized.
 51. The system of claim 46, wherein the graph isgenerated by a discovery service, the discovery service detecting assetsusing one or more adaptors and respective asset discovery tools thatgenerate an asset inventory and a network map of the enterprise network.52. The system of claim 46, wherein each asset is identified as a targetwithin the enterprise network, the target being selected based on adisruption occurring in response to an attack on the target.
 53. Thesystem of claim 52, wherein the disruption is based on one or moremetrics.
 54. The system of claim 53, wherein the one or more metricscomprise loss of technical resources, physical losses, disruption inservices, and financial losses.